OBIT
← ALL RESEARCH
RBWO · PROPOSAL

Weights that only run
where they're allowed.

Obit's distributed inference network needs to work with machines we don't control. The workers on those machines can see model shards and intermediate states, which creates a risk of model-weight theft.

THE PROPOSAL
RBWO aims to reduce model-weight theft by making the shards visible to workers usable only through an authorized runtime. That runtime holds secret transforms outside the workers' trust domain.

This is a narrower goal than "private inference" or cryptographic model confidentiality. RBWO sits between sending plaintext weights to workers and using full confidential computing.

We don't claim stronger formal security than FHE, MPC or GPU TEEs. Those approaches target different security properties and still cost minutes per token at 7B. RBWO may be easier to deploy on commodity and marketplace GPUs. It also aims to prevent reuse of stolen weights, while watermarking and fingerprinting help identify misuse after it happens. We still need to measure throughput and practical resistance to theft.

DESIGN RULES
Bind shards to the runtime
RBWO binds model shards to a runtime and keeps the required keys separate from workers. It does not claim to solve general neural obfuscation.
Keep the ends trusted
The tokenizer, token embedding, final norm, LM head and sampling stay in a trusted service. We would expose transformed versions only if experiments showed that doing so was safe.
Exact, architecture-compatible transforms
Transforms must preserve the model's computation. The design uses orthogonal residual-stream transforms with RMSNorm scales folded into the following projections. FFN intermediate permutations are shared by the gate, up and down projections. Attention transforms are allowed only where they commute with rotary embeddings.
Separate provider control domains
We place boundaries between domains controlled by different providers, rather than necessarily between every layer. We need to show that no untrusted coalition has a complete executable path from tokens to logits.
Account for exposed traces
With enough transformed activations, logits and sampled tokens collected under a fixed key, workers may learn the missing adapters. Any security claim must account for how much of this data an attacker can collect.
PROTOTYPE EVALUATION

A prototype needs to measure whether an attacker can recover a usable model, as well as the effect on accuracy and latency. Preserving quality and speed isn't enough if the weights can still be stolen. The intended protection is computational and economic, rather than a cryptographic guarantee.

RBWO is a proposal informed by the model-weight security and private-inference literature. We haven't built a prototype or measured its performance yet.